Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 618612 (CVE-2017-5849) - media-libs/netpbm: ITFFRGBAImageGet out-of-bounds read and write (CVE-2017-5849)
Summary: media-libs/netpbm: ITFFRGBAImageGet out-of-bounds read and write (CVE-2017-5849)
Status: IN_PROGRESS
Alias: CVE-2017-5849
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor
Assignee: Gentoo Security
URL: http://bugzilla.maptools.org/show_bug...
Whiteboard: B3 [upstream cve]
Keywords:
Depends on:
Blocks:
 
Reported: 2017-05-16 06:21 UTC by GLSAMaker/CVETool Bot
Modified: 2020-06-20 01:48 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description GLSAMaker/CVETool Bot gentoo-dev 2017-05-16 06:21:43 UTC 
CVE-2017-5849 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5849):
  tiffttopnm in netpbm 10.47.63 does not properly use the libtiff
  TIFFRGBAImageGet function, which allows remote attackers to cause a denial
  of service (out-of-bounds read and write) via a crafted tiff image file,
  related to transposing width and height values.
Comment 1 SpanKY gentoo-dev 2018-01-30 03:53:43 UTC 
netpbm maintainer (Bryan Henderson) is on the upstream bug, so going to wait for them to sort it out
Comment 2 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-03-15 16:02:42 UTC 
(In reply to SpanKY from comment #1)
> netpbm maintainer (Bryan Henderson) is on the upstream bug, so going to wait
> for them to sort it out

new upstream links:
https://gitlab.com/libtiff/libtiff/-/issues/76
https://gitlab.com/libtiff/libtiff/-/issues/77